Thanks for the point in the right direction. I managed to find the
account that had been hijacked and I just locked it down.
So... How about my other question?
Imail and ISCSI SAN??? Does it work, and how well does it work.
-Nico
John Doyle wrote:
Nick
I had this happen once, fire up the Imail log analyzer in your imail
folder, run it on your sysmmdd.txt log for the day this issue came up.
Check everything and run it. Look for way out of bounds senders.
this could be anything, but check smtp senders, but could be anything.
With luck you should see some user with high outgoing numbers, pull
the user up and disable the account, or change the password. If they
belong to you I'd make sure it was a stolen user id and pw and not an
infected user computer.
Good luck
John
-----Original Message-----
From: "Nico Gazzano" <[EMAIL PROTECTED]>
Sent 9/6/2007 11:01:46 AM
To: "Imail_Forum" <[email protected]>
Subject: [IMail Forum] Imail queue keeps flooding!!
I'm having a serious problem with my Imail server. About 3 times in
the past two weeks I have had to go in and stop all imail services and
delete GSE, SMD, and VAC files in the spool directory because
something is flooding the queue, roughly 5k-6k messages in a matter of
minutes.
To bandage it up I run my sniffer and block the culprit IP on the
perimeter. More of a deterrent than a solid fix, but I can't find the
cause of the problem and I was wondering if someone can point me in
the right direction.
I'm also looking into using and ISCSI SAN to hold my
domains/users/spool directories, has anyone implemented this and does
it work well?
iMail setup is as follows:
Installed on VMware Host
using local user authentication.
using local mailbox folders.
relaying only allowed for specified IP addresses.
no AV on server
external barracuda spam filter
Not using virtual domains
-Nico
--
Nico Gazzano
Data Center Manager
MIS Choice Inc.
Phone: 847-690-1900 ex 206
Fax: 847-690-1350
Email: [EMAIL PROTECTED]
